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REMMtKS 

The Office Action dated October 13, 2009, and Advisory- 
Action dated January 5, 2010, have been received and carefully 
considered. In this response, claims 1, 37, and 38 have been 
amended. No new matter has been added. Entry of the amendments 
to claims 1, 37, and 38 is respectfully requested. 
Reconsideration of the pending rejections in the present 
application is also respectfully requested based on the 
following remarks . ^ 

I . THE OBVIOUSNESS REJECTION OF CLAIMS 1-6, 18, 37, AND 38 

On pages 3-5 of the Office Action, claims 1-6, 18, 37, and 
38 were rejected under 35 U.S.C. § 103(a) as being unpatentable 
over U.S. Patent Application Publication No. US2003/0065926A1 to 
Schultz et al . ("Schultz") in view of U.S. Patent No. 7,210,040 
to Jordan ("Jordan"). This rejection is hereby respectfully 
traversed. 



^ As Applicant's remarks with respect to the Examiner's rejections are 
sufficient to overcome these rejections, Applicant's silence as to assertions 
made by the Examiner in the Office Action or certain requirements that may be 
applicable to such rejections (e.g., assertions regarding dependent claims, 
whether a reference constitutes prior art, whether references are legally 
combinable for obviousness purposes) is not a concession by Applicant that 
such assertions are accurate or such requirements have been met, and 
Applicant reserves the right to analyze and dispute such in the future. 
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Under 35 U.S.C. § 103, the Patent Office bears the burden 

of establishing a prima facie case of obviousness. In re Fine , 

837 F.2d 1071, 1074 (Fed. Cir. 1988). There are four separate 

factual inquiries to consider in making an obviousness 

determination: (1) the scope and content of the prior art; {2) 

the level of ordinary skill in the field of the invention; (3) 

the differences between the claimed invention and the prior art; 

and (4) the existence of any objective evidence, or "secondary 

considerations," of non-obviousness. Graham v. John Deere Co. , 

383 U.S. 1, 17-18 (1966); see also KSR Int'l Co. v. Teleflex 

Inc. , 127 S. Ct, 1727 (2007). An "expansive and flexible 

approach" should be applied when determining obviousness based 

on a combination of prior art references. KSR , 127 S. Ct. at 

1739. However, a claimed invention combining multiple known 

elements is not rendered obvious simply because each element was 

known independently in the prior art. Id. at 1741. Rather, 

there must still be some "reason that would have prompted" a 

person of ordinary skill in the art to combine the elements in 

the specific way that he or she did. Id.; In re Icon Health & 

Fitness, Inc. , 496 F.3d 1374, 1380 (Fed. Cir. 2007) . Also, 

modification of a prior art reference may be obvious only if 

there exists a reason that would have prompted a person of 

ordinary skill to make the change. KSR , 127 S. Ct. at 1740-41. 
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Regarding claim 1, the Examiner asserts that the claimed 

invention would have been obvious in view of Schultz and Jordan. 

Applicant respectfully disagrees. However, in order to forward 

the present application toward allowance. Applicant has amended 

claim 1 to more specifically define the claimed invention, and 

specifically those features that further differentiate the 

claimed invention from Schultz and Jordan, as well as the other 

cited references. In particular, Applicant respectfully submits 

that Schultz and Jordan, either alone or in combination, fail to 

disclose, or even suggest, a method for providing computer 

security comprising: determining, using a processor, whether an 

executable associated with a static state meets one or more 

first predetemined criteria; associating a first risk level 

with the executable based at least in part upon whether the 

executable meets the one or more first predetermined criteria; 

determining whether a current process associated with the 

executable meets one or more second predetermined criteria ; 

associating a second risk level with the current process based 

at least in part upon whether the current process meets the one 

or more second predetermined criteria, wherein the current 

process is initially associated with the first risk level, and 

wherein the first risk level is updated to the second risk level 

for the current process based at least in part upon whether the 
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current process meets the one or more second predetermined 

criteria ; and performing a predetermined responsive action with 

respect to the process if the second risk level exceeds a threat 

detection threshold; wherein determining whether the executable 

meets the one or more first predetermined criteria does not 

comprise comparing the executable with a virus signature, as 

presently claimed. 

In contrast, Schultz discloses detecting malicious 

executables by analyzing byte sequences extracted from the 

binary code of such executables and applying a set of detection 

rules designed to detect sequences associated with malicious 

code. See, e.g., paragraphs [0104] - [0106] and [0109]. 

Executables for which a definitive determination cannot be made 

using existing rules are designated as borderline. See, e.g., 

paragraph [0098] . In Schultz, the rule set is updated 

periodically, based on offline analysis by experts of the 

borderline executables. See, e.g., paragraphs [0107] and 

[0108] . The analysis described by Schultz is performed 

statically on binary code comprising the executable, prior to 

the executable being allowed to execute on a system to which it 

has been sent. Purely static analysis (i.e., not while the 

executable is executing) , with periodic offline refinement of a 

set of rules used to perform the static analysis, is not the 
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same as " determining whether a current process associated with 

the executable meets one or more second predetermined criteria , " 

and " associating a second risk level with the current process 

based at least in part upon whether the current process meets 

the one or more second predetermined criteria, wherein the 

current process is initially associated with the first risk 

level, and wherein the first risk level is updated to the second 

risk level for the current process based at least in part upon 

whether the current process meets the one or more second 

predetermined criteria ," as recited in claim 1. 

Also, Jordan discloses a system for detecting computer 

viruses that includes an emulator. In Jordan, the "[e]xecution 

of computer executable code in a subject file is emulated by 

emulator 31," See, column 5, lines 36-38. Jordan explains that 

"[w]hile the program file is being emulated, monitor component 

32 monitors the code execution . . . [and] detector component 33 

detects an attempt by the emulated code to access one or more of 

the restricted computer system resources." See, column 5, lines 

38-47. Emulating the execution of executable code in a file 

(which requires the presence of an emulator) is not the same as 

" determining whether a current process associated with the 

executable meets one or more second predetermined criteria , " and 

" associating a second risk level with the current process based 
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at least in part upon whether the current procesa meets the one 

or more second predetermined criteria, wherein the current 

process is initially associated with the first risk level, and 

wherein the first risk level is updated to the second risk level 

for the current process based at least in part upon whether the 

current process meets the one or more second predetermined 

criteria," as recited in claim 1. 

Further, the Examiner indicates in his remarks that claim 1 
is not specific regarding the execution environment for the 
executable. However, Applicant notes that this issue is moot as 
both Schultz and Jordan fail to disclose, or even suggest, 
" associating a second risk level with the current process based 
at least in part upon whether the current process meets the one 
or more second predetermined criteria, wherein the current 
process is initially associated with the first risk level, and 
wherein the first risk level is updated to the second risk level 
for the current process based at least in part upon whether the 
current process meets the one or more second predetermined 
criteria," as recited in claim 1, 

At this point. Applicant respectfully notes that, as stated 
in MPEP § 2143.03, to establish prima facie obviousness of a 
claimed invention, all the claim limitations must be taught or 
suggested by the prior art. In re Royka , 4 90 F.2d 981 (CCPA 
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1974). That is, " [a] 11 words in a claim must be considered in 

judging the patentability of that claim against the prior art." 

In re Wilson , 424 F.2d 1382 (CCPA 1970) . Also, as stated in 

MPEP § 2141.02, in determining the differences between the prior 

art and the claims, the question under 35 U.S.C. 103 is not 

whether the differences themselves would have been obvious, but 

whether the claimed invention as a whole would have been 

obvious. Distilling an invention down to the "gist" or "thrust" 

of an invention disregards the requirement of analyzing the 

subject matter "as a whole." W.L. Gore & Associates, Inc. v. 

Garlock, Inc. , 721 F.2d 1540 (Fed. Cir. 1983), cert, denied, 469 

U.S. 851 (1984). Further, as stated in MPEP § 2141.02, "[A] 

patentable invention may lie in the discovery of the source of a 

problem even though the remedy may be obvious once the source of 

the problem is identified. This is part of the "subject matter 

as a whole" which should always be considered in determining the 

obviousness of an invention under 35 U.S.C. § 103." In re 

Sponnoble , 405 F.2d 578, 585 (CCPA 1969). 

In view of the foregoing. Applicant respectfully submits 
that claim 1 should be allowable over Schultz and Jordan. 

Regarding claims 37 and 38, while different in overall 
scope from claim 1, these claims recite subject matter related 
to claim 1. Thus, the arguments set forth above with respect to 
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claim 1 are equally applicable to claims 37 and 38. 

Accordingly, Applicant respectfully submits that claims 37 and 

38 should be allowable over Schultz and Jordan for the same 

reasons as set forth above with respect to claim 1 . 

Regarding claims 2-6 and 18, these claims are dependent 

upon independent claim 1. If an independent claim is nonobvious 

under 35 U.S.C. 103, then any claim depending therefrom is 

nonobvious. In re Fine , 837 F.2d 1071 (Fed. Cir. 1988). Thus, 

since independent claim 1 should be allowable as discussed 

above, claims 2-6 and 18 should also be allowable at least by 

virtue of their dependency on independent claim 1. Moreover, 

these claims recite additional features which are not disclosed, 

or even suggested, by the cited references taken either alone or 

in combination. 

In view of the foregoing, Applicant respectfully requests 
that the aforementioned obviousness rejection of claims 1-6, 18, 
37, and 3 8 be withdrawn. 

II . THE OBVIOUSNESS REJECTION OF CLAIMS 7, 8, 10, 12-17, 29-34 

On pages 6-12 of the Office Action, claims 7, 8, 10, 12-17, 
and 29-34 were rejected under 35 U.S.C. § 103(a) as being 
unpatentable over U.S. Patent Application Publication No. 
US2003/0065926A1 to Schultz et al . ("Schultz") in view of U.S. 
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Patent No. 7,210,040 to Jordan ("Jordan") further in view of 

U.S. Patent Application Publication No. US2004/0143749A1 to 

Tajalli et al . ("Tajalli"), This rejection is hereby 

respectfully traversed. 

Applicant respectfully submits that the aforementioned 

obviousness rejection of claims 7, 8, 10, 12-17, and 2 9-34 has 

become moot in view of the deficiencies of the primary 

references (i.e., Schultz and Jordan) as discussed above with 

respect to independent claim 1. That is, claims 7, 8, 10, 12- 

17, and 29-34 are dependent upon independent claim 1 and thus 

inherently incorporate all of the limitations of independent 

claim 1. Also, the secondary reference (i.e., Tajalli) fails to 

disclose, or even suggest, the deficiencies of the primary 

references as discussed above with respect to independent claim 

1. Indeed, the Examiner does not even assert such. Thus, the 

combination of the secondary reference with the primary 

references also fails to disclose, or even suggest, the 

deficiencies of the primary references as discussed above with 

respect to independent claim 1. Accordingly, claims 7, 8, 10, 

12-17, and 29-34 should be allowable over the combination of the 

secondary reference with the primary references at least by 

virtue of their dependency on independent claim 1. Moreover, 

claims 7, 8, 10, 12-17, and 29-34 recite additional features 
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which are not disclosed, or even suggested, by the cited 

references taken either alone or in combination. 

In view of the foregoing, Applicant respectfully requests 
that the aforementioned obviousness rejection of claims 7, 8, 
10, 12-17, and 29-34 be withdrawn, 

III. THE OBVIOUSNESS REJECTION OF CLAIMS 9, 11, 35, AND 3 6 

On pages 12-13 of the Office Action, claims 9, 11, 35 and 
36 were rejected under 35 U.S.C. § 103(a) as being unpatentable 
over U.S. Patent Application Publication No. US2 003/0065926A1 to 
Schultz et al. ("Schultz") in view of U.S. Patent No. 7,210,040 
to Jordan {"Jordan") further in view of U.S. Patent Application 
Publication No, US2005/0108562A1 to Khazan et al . ("Khazan") . 
This rejection is hereby respectfully traversed. 

Applicant respectfully submits that the aforementioned 
obviousness rejection of claims 9, 11, 35 and 36 has become moot 
in view of the deficiencies of the primary references (i.e., 
Schultz and Jordan) as discussed above with respect to 
independent claim 1. That is, claims 9, 11, 35 and 36 are 
dependent upon independent claim 1 and thus inherently 
incorporate all of the limitations of independent claim 1. 
Also, the secondary reference (i.e., Khazan) fails to disclose, 
or even suggest, the deficiencies of the primary references as 
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discussed above with respect to independent claim 1. Indeed, 

the Examiner does not even assert such. Thus, the combination 

of the secondary reference with the primary references also 

fails to disclose, or even suggest, the deficiencies of the 

primary references as discussed above with respect to 

independent claim 1, Accordingly, claims 9, 11, 35 and 36 

should be allowable over the combination of the secondary 

reference with the primary references at least by virtue of 

their dependency on independent claim 1. Moreover, claims 9, 

11, 35 and 36 recite additional features which are not 

disclosed, or even suggested, by the cited references taken 

either alone or in combination. 

In view of the foregoing, Applicant respectfully requests 

that the aforementioned obviousness rejection of claims 9, 11, 

35 and 36 be withdrawn. 

IV. CONCLUSION 

In view of the foregoing. Applicant respectfully submits 
that the present application is in condition for allowance, and 
an early indication of the same is courteously solicited. The 
Examiner is respectfully requested to contact the undersigned by 

telephone at the below listed telephone number, in order to 
expedite resolution of any issues and to expedite passage of the 
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present application to issue, if any conunents, questions, or 

suggestions arise in connection with the present application. 

To the extent necessary, a petition for an extension of 
time under 37 CFR § 1.136 is hereby made. 

Please charge any shortage in fees due in connection with 
the filing of this paper, including extension of time fees, to 
Deposit Account No. 50-0206, and please credit any excess fees 
to the same deposit account. 




Registration No. 37,063 

TEA/vrp 

Hunton & Williams LLP 
1900 K Street, N.W. 
Washington, D.C. 20006-1109 
Telephone: (202) 955-1500 
Facsimile: (202) 778-2201 

Date: January 13, 2010 



66865. 00120B EKF_US 29389723V1 



22 



